128a621cee920bb777cebfc5e3e781248b5c23a0bd76405a1e04a911e66038a7

Analysis

max time kernel
74s
max time network
85s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
12/07/2023, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VideoPadVideoEditor.exe
Size

5.8MB
MD5

a9d1fdf7316e5d762fe9b20842367d99
SHA1

5636f5de3e1b6cb14437e7b2e7b45eafc83e1ead
SHA256

128a621cee920bb777cebfc5e3e781248b5c23a0bd76405a1e04a911e66038a7
SHA512

1acb2787233d200e8c4f8a4c95c1092a7898a9899702c86c28171fd2466d281b8758a7b84b7556ebee42c0a5d39e379797594892ae5602b003e5d7db85c033cd
SSDEEP

98304:ay05jlcx0QMWgzWQ7mN+cOGHzFfDEe+8SnLHTKAmWu4JWY9UQvcPBt3bNAv:aE107mNCoSe+jlY4hOUcPBtg

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	nchsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\VideoPadInstall = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VideoPadVideoEditor.exe"	nchsetup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Control Panel\International\Geo\Nation	videopad.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\ffmpeg23\swresample-0.nch.dll	ffmpeg23.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\scratched.jpg	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\ffmpeg23\swscale-2.nch.dll	ffmpeg23.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\938__wt	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\waterdamage.jpg	videopad.exe
File created	C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\mp3el2\__wt	mp3el2.exe
File created	C:\Program Files (x86)\NCH Software\Components\mp3el2\lame.exe	mp3el2.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\folded.jpg	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\grainy.jpg	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\hazy.jpg	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\ffmpeg23\__wt	ffmpeg23.exe
File created	C:\Program Files (x86)\NCH Software\Components\ffmpeg23\avcodec-55.nch.dll	ffmpeg23.exe
File created	C:\Program Files (x86)\NCH Software\Components\ffmpeg23\avutil-52.nch.dll	ffmpeg23.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures.zip	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\streaked.jpg	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\torn.jpg	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\ffmpeg23\avformat-55.nch.dll	ffmpeg23.exe
File created	C:\Program Files (x86)\NCH Software\VideoPad\videopadsetup_v13.50.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\dust.jpg	videopad.exe
File created	C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\filmlines.jpg	videopad.exe

Executes dropped EXE 5 IoCs

pid	Process
2360	nchsetup.exe
2400	mp3el2.exe
2548	ffmpeg23.exe
1600	videopad.exe
1780	videopad.exe

Loads dropped DLL 32 IoCs

pid	Process
568	VideoPadVideoEditor.exe
568	VideoPadVideoEditor.exe
568	VideoPadVideoEditor.exe
568	VideoPadVideoEditor.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe
2360	nchsetup.exe

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\Wow6432Node\CLSID\{7aab499f-3a32-4ed3-99e8-5a5194f0e7a3}\LocalServer32	nchsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\Wow6432Node\CLSID\{7aab499f-3a32-4ed3-99e8-5a5194f0e7a3}\LocalServer32\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" -systemnotifyevent"	nchsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\hardware\description\system\CentralProcessor\0	videopad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	videopad.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	videopad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	videopad.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.nchsoftware.com\ = "46"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\nchsoftware.com\Total = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.nchsoftware.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.nchsoftware.com\ = "21"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\nchsoftware.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "46"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\nchsoftware.com\Total = "46"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16BC8341-20B3-11EE-BEB1-DEF85CD8AB75} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000\Software\Microsoft\Internet Explorer\DOMStorage\nchsoftware.com	IEXPLORE.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpe\shell\Add to VideoPad Project\command\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" -add \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpe\Shell	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.f4v\Shell\Add to VideoPad Project\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.cr2\Shell\NCHconvertimage\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpg\Shell	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ico\Shell\NCHeditphoto\ = "Edit your photos with PhotoPad"	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.VideoPad.mpe\shell\open\command	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg\shell\Stabilize Video\command\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" -stabilize \"%L\""	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.VideoPad.kmv\DefaultIcon\ = "C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe,0"	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.jp2	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.psd\Shell	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.VideoPad.mov\DefaultIcon\ = "C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe,0"	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\ddpfile\shell\open\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ogm	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.asx\Shell\Add to VideoPad Project	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\dssfile\shell	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.webm\Shell\NCHconvertvideo\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mod\Shell\Stabilize Video	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mts\Shell\Stabilize Video	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wtv\shell\Add to VideoPad Project\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.webp	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tod\Shell\Stabilize Video\command\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" -stabilize \"%L\""	nchsetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\OpenWithProgIds\NCH.VideoPad.m4v = "0"	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.raf	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mp4\Shell\Add to VideoPad Project\command\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" -add \"%L\""	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.VideoPad.mpeg\shell\ = "Open"	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ts	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.nef\Shell\NCHconvertimage\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.tar\Shell\NCHextract\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.VideoPad.mpg	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.VideoPad.div\shell	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.VideoPad.m2p\Shell\open\command\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.gif	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flv\shell\Add to VideoPad Project\command\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" -add \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.kmv\Shell\Add to VideoPad Project\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.oga\Shell\NCHconvertsound	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mov\Shell\NCHconvertvideo	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.y4m\Shell\Add to VideoPad Project\command\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" -add \"%L\""	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.m4a\Shell\NCHeditsound\ = "Edit sound file with WavePad"	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.tar	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heic\Shell\NCHeditphoto\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.rw2\Shell\NCHslideshow\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.mqv\OpenWithProgIds	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mxf\Shell\Add to VideoPad Project	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.VideoPad.vob\shell\open\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.VideoPad.xmv\shell	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.caf\Shell	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dng	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.VideoPad.wtv\shell\ = "Open"	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wma\Shell\NCHconvertsound\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.bmp	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.VideoPad.kmv	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.7z	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.bz2	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.gsm\Shell\NCHconvertsound	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.evo\shell\Stabilize Video\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.voc\Shell	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mod\Shell	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.VideoPad.mov\shell\open\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.3gpp\Shell\Add to VideoPad Project	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.flac\Shell\NCHeditsound\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpg\Shell\Stabilize Video\command	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mxf\shell\Stabilize Video\command\ = "\"C:\\Program Files (x86)\\NCH Software\\VideoPad\\videopad.exe\" -stabilize \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.nsv\Shell\Stabilize Video\command	nchsetup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2360	nchsetup.exe
2360	nchsetup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1600	videopad.exe
2220	iexplore.exe
2220	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 2360	568	VideoPadVideoEditor.exe	29
PID 568 wrote to memory of 2360	568	VideoPadVideoEditor.exe	29
PID 568 wrote to memory of 2360	568	VideoPadVideoEditor.exe	29
PID 568 wrote to memory of 2360	568	VideoPadVideoEditor.exe	29
PID 568 wrote to memory of 2360	568	VideoPadVideoEditor.exe	29
PID 568 wrote to memory of 2360	568	VideoPadVideoEditor.exe	29
PID 568 wrote to memory of 2360	568	VideoPadVideoEditor.exe	29
PID 2360 wrote to memory of 2400	2360	nchsetup.exe	30
PID 2360 wrote to memory of 2400	2360	nchsetup.exe	30
PID 2360 wrote to memory of 2400	2360	nchsetup.exe	30
PID 2360 wrote to memory of 2400	2360	nchsetup.exe	30
PID 2360 wrote to memory of 2548	2360	nchsetup.exe	32
PID 2360 wrote to memory of 2548	2360	nchsetup.exe	32
PID 2360 wrote to memory of 2548	2360	nchsetup.exe	32
PID 2360 wrote to memory of 2548	2360	nchsetup.exe	32
PID 1600 wrote to memory of 2220	1600	videopad.exe	36
PID 1600 wrote to memory of 2220	1600	videopad.exe	36
PID 1600 wrote to memory of 2220	1600	videopad.exe	36
PID 1600 wrote to memory of 2220	1600	videopad.exe	36
PID 2220 wrote to memory of 2844	2220	iexplore.exe	37
PID 2220 wrote to memory of 2844	2220	iexplore.exe	37
PID 2220 wrote to memory of 2844	2220	iexplore.exe	37
PID 2220 wrote to memory of 2844	2220	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\VideoPadVideoEditor.exe
"C:\Users\Admin\AppData\Local\Temp\VideoPadVideoEditor.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\VideoPadVideoEditor.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe
    "C:\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe" -LQUIET -instby fiVideoPad -instsvar LLIBInstquickoff
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\VideoPad-2156-1\ffmpeg23.exe
    "C:\Users\Admin\AppData\Local\Temp\VideoPad-2156-1\ffmpeg23.exe" -LQUIET -instby coVideoPad -instsvar LLIBInstquickoff
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:2548
- - C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe
    "C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe"
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://www.nchsoftware.com/software/thanks.html?software=VideoPad&appname=VideoPad&version=13.50&appbits=32&base=videopad&domain=nchsoftware&buyoffer=videopad&pclass=plus&rgst=0&antivirus=expired&instby=dl&iid=qm11q9hc0N4&help=0&ostype=1&osver=6.1&svar=LLIBInstquickoffVIDEOPADSSQualv2onLLIBControloffVIDEOPADSplashv2onLLIBSpllnkuloffLLIBSpltxtfadeoffIRBgY6qtUDmdAs0xVB5eBFBqPDPpIfzrAduxESiqOFubCcicAqhvHHRxY0dwTGabSl7tA1qhN9leWf4qVIDEOPADAddmediaonCFYrGUObATIjAryvJ7nhEbkgKG3tGjkhAIwhSg2vCNbmIJNmEZZrZH8hVIDEOPADSofttbsoffDZ3qRXDeLLIBDbdispkclronF0ouF0qfYuipNPtkP1ysB3knCMZkYo8qNB3q&usage=0B5501&usagestats=gpu_0_0(1)&usechoice=llinad(1)&daysusedprogram=1&secsfr=16
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2220
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2844
- - C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe
    "C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe" -installsched
    3⤵
    - Executes dropped EXE
    PID:1780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5e0
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\NCHSOF~1\COMPON~1\Shared\DUSTSC~1.ZIP

Filesize
1.3MB

MD5
d0f35d4643a95944880d74b55308877a

SHA1
d18df7b0c761f62131a47763eec8167e3bd80100

SHA256
0496486044da4a7a3f2494e10be2f5508fb3c6d0476c96f34b9b4cfa2767228b

SHA512
fdc0e0648a33fb97f89c1f15803a7b9f1e7f025647e6beb8d6c89ad7892f4ef403493cd8e3c3e7314c375b7466cb176495c1fd02a11921184f8ca0014ddbc041

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\dust.jpg

Filesize
107KB

MD5
9209adb704259b683a1b2ae5afb0c472

SHA1
361afa020098807d94c33dae87b33630af838905

SHA256
7e3304976114564c485c4ba7fd855ed3076d9ced7eefecb306d509bf5c6face3

SHA512
7d5d3f2c81298be0546afe98bec187f849df4bb3d0d5abfadcb55019585d6ef9a67929ab10929f5a5dfefa5598bee48b5398adda172651911a90011edc307b33

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\filmlines.jpg

Filesize
41KB

MD5
4ccb5c20b48d7489cba750f098bebf84

SHA1
741b8a275ae6b52dfbc5daf00fc4d1d80a07fb68

SHA256
6365802684f3f5e82444b2a17d9840be93c076637bd17a5eb963fd6e0ca7a542

SHA512
613163f3337c9347e2340194c1b584a04d66d88c74aa2093502cb68a7867b899d6b1af44ddaf5127bc2aea7ed1a5439a62a88fcc01011e21b292dcd2f4c0b0e5

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\folded.jpg

Filesize
683KB

MD5
30738cadc80a40d71c5f88ed5d371d2f

SHA1
3b7d5f79d1213bc1b6e12ec6f059d9afa22f759a

SHA256
cbea948c3187b7a974b7ad1064264d12e091b7ae8c9491c0608efbe8b1e9ff62

SHA512
f0bd5b3112696fc104bc48e148ee92baddbea503576b24bb4b3b6c7aa3a3e8adbfa94de72e13768947c02310653bb771d1b221c66b0471353eb73b1a41b51fc3

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\grainy.jpg

Filesize
92KB

MD5
774f09c1ae56760b62ee761d09aaf77f

SHA1
e661282aeda9333d1f8db06b7b75fa8a7a2ef193

SHA256
3c2a512ce2c8e60d57a558528430c17a333a2015b6106e17889e3c3f9ffc8f6c

SHA512
21d589b832a58ba76c09f589786f2e8fa94b880017837acc1560a05e105fda5c568d2fd129e5daf9772d08e8780e01c20a2cdd9bc6ef134d4fa61b0c7428f943

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\hazy.jpg

Filesize
186KB

MD5
ce93c47ac828dbc9e294b7798f3a8f51

SHA1
0b0b6a778a047184a4894642477c9ec6effff21b

SHA256
378c7f63d7f272bcb345113411c300c92d26378e22c1381dd5bbf94711d06b0c

SHA512
32aeca77e422ec32ff885d8fc91877d90c5e61ad91567819782d2f79d429062b386e8ba6f48b9909a7a97af9821c71588252ee7ce015b9c93614fc3456f1957e

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\scratched.jpg

Filesize
46KB

MD5
3a393f8e4479f50eb73171a2aac3ea9a

SHA1
4393ed598948a409f4f6dcf0f12cbe89c802f705

SHA256
08b1edeb04dc0c7555609337f11a516e5ca52f94a392e9f528198d6e4a5a8b61

SHA512
7c6836f11b506e7dd32d8999aac762b1fef411877362a75e368d35b1eb653e402b9ff81b97ac849214ff746ca7b9edae65fc0ff31ba2e46b2461ddcc29aed1f7

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\streaked.jpg

Filesize
67KB

MD5
7cd69e6cb88fca6ee8df073e4dae1236

SHA1
c880f4c32693bb004f9f5b639dc701b414898aa1

SHA256
bf202ee793ade6afb4c9a02609def0a6fdbe1c1e8eeeaa09f7bbf99e6e17eda8

SHA512
ed7c937616f4017784545f77054b78f90da7425f0b3b97bd8e5272726831abfc9e3563d1692e9ce0645ae85ebaddafc4003d4f37caae5bb6cb48c99f873ce94d

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\torn.jpg

Filesize
65KB

MD5
656f79eacbe45d69f7555864bf954750

SHA1
c8f241a6e2416e804565bf38c33f3964b60444ca

SHA256
cb11a77787a02ef50596966ca620355d2ce1549e408517e658c588a85dd68eb0

SHA512
e43954bd4bbb8b58bbf487aaae21935e4a651bcd09af37d45b7e5fcb8eacf30a5dd7bba1e63da01496e259d17877073905ee201bdb1fc0564c092ae595a7c598

Download Submit
C:\Program Files (x86)\NCH Software\Components\Shared\dustscratch_textures\dustscratch_textures\waterdamage.jpg

Filesize
80KB

MD5
acbf3a7d0d123c006c110c390f264cc5

SHA1
0da95346ba49f6032578179d348246b4c2190cc8

SHA256
30ef21ec5728be0da8acd1554540060dd609bfaa4488f21379b33bd780e855a5

SHA512
9288c3e57153cf9bcf66164b369d3fbd297f53cacfd9f384779b11c05b13cf4fbdcf628f7875902e6a7d646fcdf474be4bea2f3bcbdaf8a3e6543dde16e7c31d

Download Submit
C:\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe

Filesize
215KB

MD5
fdbcf6d959114f3b21b1a66b606bbfe6

SHA1
bdb49a613ba82ad1bfe5db6da65ac53e2c3007d2

SHA256
fbaf4b67d2ec4efaf001331c633b3abee706fc805d4e3736a4ebc5391775ddac

SHA512
2ca2bbd174f132f5edd0fec1b420794125bb7ec66b6d8e063ced7eb81fba36c03b4b6f6cf3272a74c687471111727948cd1d21b32a8aeb29dfb19a7a6f66d425

Download Submit
C:\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe

Filesize
215KB

MD5
fdbcf6d959114f3b21b1a66b606bbfe6

SHA1
bdb49a613ba82ad1bfe5db6da65ac53e2c3007d2

SHA256
fbaf4b67d2ec4efaf001331c633b3abee706fc805d4e3736a4ebc5391775ddac

SHA512
2ca2bbd174f132f5edd0fec1b420794125bb7ec66b6d8e063ced7eb81fba36c03b4b6f6cf3272a74c687471111727948cd1d21b32a8aeb29dfb19a7a6f66d425

Download Submit
C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_0C3324DD7F97539EB372EF84C5FE5112

Filesize
471B

MD5
906a46bc517bc69dd85de5befc3e7ab6

SHA1
8f0e64d2d0b0b9e2872e4bba0ee28fcbbe7c29df

SHA256
df6da6c499f39f84065e3902613613f5e92a994775f823ff5ea28c57103d2e23

SHA512
8ce46a7cf711f853628afda84386396c9e7b2aa5932bb431f493d9c9966c74a484483aee19e9d31b7908557befb27732fa3b09359fb475b98a1b4ec4b6006e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_08ABC9BAF0306ABA284905ED28583FC8

Filesize
471B

MD5
26429f139e47f23c6d80537dd5268c32

SHA1
47d0bbdff5131d99aec0ea718dcefb4e65de16a4

SHA256
a403454cc10df80518ec17f7cd93ac9be46b8ba3a2ba301003bef238ad7c7975

SHA512
10e11869c27f1aaadbe8e31f49053e38b2214cb027d1aa2f11eca6562e72688a95a7273e6ca0fceee527c48dafc462482c52eb332c2e4c024c41f058c68d12a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34c6791edc2f5d829923b89df8d39a5b

SHA1
e4b1991049f1f0d852ab5109f146a2821c9b48b9

SHA256
36a1f9eddcc220afaafe21bb0c8e8def5d0a3c0049e1d6f1a454c3b8109339b7

SHA512
2715fce49f7a81348106181311f147aaa49a46a9975fdff814404a41076d98bc92fcf315f02bed5b77c5d4e778c2f1fe878928cb07623c28ddbc7188636da6a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5fb6746b52e60e0c1c108cb448d1093

SHA1
63c0f84da1728f60395237cbcc43e3964edced05

SHA256
9651f612e5a104b7512054528df0d8367d9ffa25278c3bce9186429c59a27d9a

SHA512
c49416b7819b9ceb9d145ce40a614180baa66ca251e6d9223a3dc6df21b308a65fe7e65695b411a8ce4b077c0c6f1b36f755048af9c600dc1ec4196d2aadfe3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5588e910c13803920f0089b91af471cf

SHA1
51fc1fc2ce1db35fb5f7ff6b74f9844645514f5a

SHA256
0fc3ad8d5d7ed145cce2e44e0ad40322344f7e85d928e28f7af95e00c996e1c0

SHA512
54b75aad60d4daf1e25ea1706c7971a4df3254c9e5e495cf42013423c408fe816f66865a0eab1e335d4b1d697238ad1270096b05faac78e7d39c3ee3f678cf86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baeb8fee0c510d2fd694dfb08ea3adb1

SHA1
d4f4d4d61509f6c1ba9ad9cf2db82f3a5c6f55c8

SHA256
7e8e118a1a0c0d8ca2025b43000e1cf841e061d776d8c7275bb0f1cb115e6135

SHA512
1095d145e8f126b61e014193b091227fe43454e45ec29964090377e620c14488f3a48f9be2125ff38cf15f0160c4c35af21c4d3d17a6f49eb4c4a9fcc34dcaa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa2fcce8e13bd2e46ad08ea450d51f8c

SHA1
87301eec07c8b921be4120e2758fcb73a440e71e

SHA256
0bc8ca1b646c8f74e1bdf9c0aae365be19207ee5064c30a9c86e25d9af4e93d5

SHA512
e2c4defcccc17ecee139bda513d884f62519df054b0fcf3c33c1e98a157ac7ab20730d415da5e335d1f923a4cfaa676385b27c51fb0827b8b213c98eb9122bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49D1.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49D2.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\VideoPad-2156-1\ffmpeg23.exe

Filesize
3.2MB

MD5
8f2dbfdbbf7d110e5093df464197641a

SHA1
8b16c932276d957103d305803b10c6d70b029680

SHA256
7cbb0774164efb5fb4a170cc854e184d8ca67ce796b6bda632fb692e89abec27

SHA512
bdcf6897575efad3eb4ccaf3c73503ed39cc0921b4f88ec24efc6597311f80422d36924599d06de244d7ab244f034693e3e6b4dacb6eee09fbadba17d075aea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\VideoPad-2156-1\ffmpeg23.exe

Filesize
3.2MB

MD5
8f2dbfdbbf7d110e5093df464197641a

SHA1
8b16c932276d957103d305803b10c6d70b029680

SHA256
7cbb0774164efb5fb4a170cc854e184d8ca67ce796b6bda632fb692e89abec27

SHA512
bdcf6897575efad3eb4ccaf3c73503ed39cc0921b4f88ec24efc6597311f80422d36924599d06de244d7ab244f034693e3e6b4dacb6eee09fbadba17d075aea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat

Filesize
300KB

MD5
f9a2f72624c06fcd642564c7c1337c11

SHA1
7f59082046f49734d1c302b4c49b5df7f8b26190

SHA256
ced2d006a40b7fcb7f160b7645aaf3607667ce462c88f27d887b933639849684

SHA512
bec19f1824a6190368e946e74f6021147725292dc2e1b53e06667df11f715ec61b249d90ab1fa1b4c65c7a1698bd85b0cb5daf3fde3445a9501e9d6c64214fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\ComputerPresets\PS3%20HD%201080.dat

Filesize
484B

MD5
5eecf5c5045b9f6df7920d8002dbe901

SHA1
393138a461474bccbcafc3745a752b5f183ad8c9

SHA256
de0cbf678226d04528cdfe667217eb5e24833e169a818c4d633771acfc274a1b

SHA512
3e4eb313813268a75556a7a76c845f1c77c2b643455fdfaba7b7f856d4ceb62fe390e024b3051a28226fb2847b91e9788a479042c621b273f97aced24c91fb44

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\ComputerPresets\YouTube%20-%20Vertical%20Video%20%284%3A5%29.dat

Filesize
484B

MD5
986dae1f2d8c538709acbe392d115cb5

SHA1
b964fb14fbe257ad1cdba140a4117164f9e7f8e3

SHA256
3ba76ccb0380fde1793571938bf455f70906977f174295ba81f2992ff9ef01e6

SHA512
2ebb1e8fcedf764f142117eae7b5f5c8ef137e3ff4157285dec1885897ac7241d039eb6b3c94986db88a83d0687f17052644c61c89aaf1017a4fb6482b35db0f

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\ComputerPresets\YouTube%201440p%20%282K%29.dat

Filesize
483B

MD5
4885ffe9da2d96661bf27a0e5898cac8

SHA1
6df1b3e7e8776ada563a0c3b14032239b8d46390

SHA256
d9083c33c460165687bf9402dfb3068fd096fd956e33cd9303b2d29f06684709

SHA512
dd9958fffdfdaf8ee00ddcb35495b45e03e93664f5437099d882ca315724ec9574d63d881c280e1600b0aa08542048fb32e99e931c8c3d2bedbd73e3ff1bcd0f

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\ComputerPresets\YouTube%202160p%20%284K%29.dat

Filesize
483B

MD5
ee49e3f82d40b9186643e4fcd39582b8

SHA1
c2b2cb6d3144483b5b7e9a26dd37c9b1be74e315

SHA256
97d09214d6d22f649d7c27a9ef49fc40a4d7b6aab698282062e9cf07ab468444

SHA512
bc2b0adc37f5850f6c43ace19d65820fcd43d803f67b95bb0454ed5280e3bd4e8821d6675f50474c5f547d2fecb63481672dbadec8091825341875c610c9ed71

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\ComputerPresets\YouTube%20720p.dat

Filesize
482B

MD5
b53a1851ee6a504a5b3450d1f1e18db4

SHA1
35ec235ccb19ec4080243c6bbc26442d67d5b0a5

SHA256
2d94adbaf849e40d46ec02632c7025bd53a158bd0732d7e302be2e56da8557d0

SHA512
725f5bb8f7237a0b10f86ada0ff987ac0506fb4f49517af8a40d298c8caea4ae21b6f4c7621a43fa14a4792388a91c1ab34b735e8301be724927598b48079866

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\DVDDataDiscPresets\Default.dat

Filesize
483B

MD5
d8a1d13b6a709284f4b6f03944c5a777

SHA1
92b682c0feb24ff7eff26b37179e84714dc48d7d

SHA256
3ebab07816a054e2a63d47088bc396cb35ab56f9c514e9246fded7aab2e061fa

SHA512
00a23f21cc7bca0de880dc3c8d8fe43cb668765587d7348c381816c64400da15b63a65114aa7b07ca1ad1a576937469c8987cb0c0282077688497921e36fbb43

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\DVDDataDiscPresets\YouTube%20-%20Vertical%20Video%20%289%3A16%29.dat

Filesize
484B

MD5
ed28e04db66bf78a0209ecbbd2dfef9d

SHA1
4eedf8f87f9c812cd42dc8dec516846b6b16bb6f

SHA256
f3b0af75a4537ff0d80bf14afd9288e58ba414370d8524e8145ef205e51f75f7

SHA512
77c4aec450b95241614b0f4962576340fd1104f199bfa374ab980507dee5742f9fb6a049bb25fa0c512e1e67085265951403c3d79f60aa714b155ac46e3766cc

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Animated%20GIF.dat

Filesize
203B

MD5
b87cc2e85d1b38ce6721841aeb944959

SHA1
c6dbefbbe4dff194f8011a98222bb9ddd6cc03bf

SHA256
95a0216e4b898535e9fde3e2f3dc451188fa0c7ab474cf5364ea0ed23cf1ba9b

SHA512
0bb88c58a80b8b0fb9247c191433cbb71f93336b557779ea1a4c5b65ddacff654040ef5470e980b30ff32adbcdee60173188217157f4b9818dac777280fd1cb9

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Facebook%20-%20Vertical%20Video%20%289%3A16%20-%201080%20x%201920%29.dat

Filesize
484B

MD5
1cda61236694c03e5854b89657bdc201

SHA1
555439bd9dd3499737fffb039f84869850042458

SHA256
e5377ef13c5783acfd8fceb1d4926f3c23d9c9f67aad68de6908ad99974c6698

SHA512
9147a2bdd63eea10035ffb4788734c4ef89b582a72237fada9590e5d45d45f4a9f27bde3da46e39009b641ae42d484318be74f707544c93c26c77ae16e395965

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Facebook%20-%20Vertical%20Video%20%289%3A16%20-%20720%20x%201280%29.dat

Filesize
483B

MD5
1f00842c3b8fc67011a68216886775a8

SHA1
b62e0c3ef2f37bbf8788519cbf2799ab25575a26

SHA256
d4869aab58135fb48a6c54653bbac494c30ec9f2bf447ee916b190831d4b36de

SHA512
fbb0d6c7a51576d4b931f9cc26f11f4c0fd0f468b07775e30bbac743cc3d4dde6b6e702f18437e4befe71abbf0ad4490b5277e612ed42e9a4672693ba79c57e4

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Facebook%201080p.dat

Filesize
484B

MD5
095cdcf5f0b3b9833ffceba3e9e2cb91

SHA1
01ed1292d6f9fb414ac72f72595e9c22ba00190a

SHA256
edccce9d96efb8e964ea9d67ae9d75e8a69896f2f4d2bf49b46332f98d5732e8

SHA512
8b9577fc6625959fce694eef57ee4d793ddbd04e2788d665f0cd9447917978ad7505568f70f9a305cde9a44639d748dd3a3b0f4c4bdc153d5e87f01ab93ede6b

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Facebook%20480p.dat

Filesize
481B

MD5
9d464516256be22f266a00510ee2af7e

SHA1
5b7e7346f518fcd29701cde078161e7d4a0fc203

SHA256
9032142620bcffafb741911906500159c24aa74e41e4d399a556efeaadd1cf7e

SHA512
88d52ef07cf60f2994f5c22739f5b8e7ffc4f6708c14a8d598fc53710a9892e30df44d34a789d60c741e7868c638766e7a41b2880b09116129722bb4ecde4137

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Facebook%20720p.dat

Filesize
483B

MD5
66f7701ff524c397dd386ba51cf5424c

SHA1
08d58ef9c27e2a5c4690a627220408fb848b3511

SHA256
cca275b89dabaea3d71078a883f8b2d5aa66c4c13cdcb0f4f16e4d242616e033

SHA512
c48ef0d805949c441b64583a1b09b231a9c9a1cae5f2fc0984ea63e91a0272573854827f9ff0e7b925be5b278cfd8d7a29e42e208d9863ad9f35f718549c6d5f

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Internet%20Video.dat

Filesize
447B

MD5
94ce49ca59596a8c37b670f8e9aea146

SHA1
bd4c003c4d7d99d6758be8374b69c6ba051f1660

SHA256
bf8c927f01ea3dbab2004ad9bcbf1ac11863e0b75015c7c002f092c546dce916

SHA512
a57e31f26c99261b9789ea2dc64c55e14a7974554eb6a7139e397f820f82f0a552ea08ef69290b5ddad82b6bb481e0452f307a49456b531dafa2d295848d30a6

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\PS3%20720.dat

Filesize
482B

MD5
a9e4349bd0962dab1cbeedf15231fc61

SHA1
be44b53af8766c7c4d319baa71e8b1102407ad6e

SHA256
5906d9f29338e141a6aecece90a3729ef4bdc0437428d3b3351101de81941b0e

SHA512
1324394ecf08e9f9aa9cd896f9df0acc5cb93547272d129c7752af22442d74973c8d5c4e9679bd227367e451e54b09073a3b1aed3b8f1c7ee9523b5ce106dcd1

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\PS4%20Pro.dat

Filesize
484B

MD5
6085a62ed0909dde1baa21880f53a9db

SHA1
160787a65973cff18ce85c828454bb7bd0addb24

SHA256
17cbe4143db916c4e79e1f491112f21359db46379f7985678c34fc3ae6b5c24c

SHA512
c0e6391cfbf000e1973b58bde16162e8154a0fb8cc8f4b7fd6bce1ec3744213da2d8e50399b904feb9bf42a0fd7d9f99a264d2d095799c76a28a9696a3abf594

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\PS5.dat

Filesize
484B

MD5
fa64fb416dcf191fc93c3caebedc311f

SHA1
247d211e91c61ada2780d5ba0d792dd7f595dc6d

SHA256
ad926282a522b563f2547935054ee3bb0022dbdcd8c0964b56b9286fe4eb1a1b

SHA512
ff01873689d9df78297471e7a9ccc16102c83b438ca921c29efa37924e120e412670ee56e2a168877a9681190768e5e9c23860883d48cb2dcc3076a79416b4d0

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\TV%20NTSC.dat

Filesize
481B

MD5
0156fbc4bfd6e88b9a69d0a50cef0123

SHA1
9c18e7f4c66a966078bc697a3288551d3501365d

SHA256
e8a9783152f0c00f2406660bcd53d477a4079a4399ef92a69dae5110e75f4767

SHA512
4c87db505e39c1d94384269477bfd5c8ff1498df97c5ca780509bf8038a2cd6f3eda79d26bb397b3df6aec09bfdafcb0547f4d58b9d8d5aca254b90233fad68e

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\TV%20PAL.dat

Filesize
481B

MD5
1d0d31b5da6de39ef04b1b1e9ffd5523

SHA1
d47d1afd0b0406311c24684c1be1743ee15e1917

SHA256
371b1290b7d047a3f8542fd1a9bc21c489c70cfb0392ed9534dfa96db97733e8

SHA512
e8f79675d70640ef7dbd1e327f0b5cd8a95ad3df2227bcf0e496b8fe8c70abf1cdcb86b1fd8308b0a6be8eefdb040c648543336d324b0ea9630da3e18d4b4ef0

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Twitter%20MP4.dat

Filesize
482B

MD5
f26e6a1f86f44e3e0fbb8f0703cd49c2

SHA1
fa1345c08155dbeac4058475cb3ed59d7e69c2c8

SHA256
9cb4f1ab44fae1ff467d88be05069afbd605e5a2dce42f40d0cf03b9d761693d

SHA512
02e716e56f72e1461a3d4d6c1cba9086581009b5f658c74cb51a0a2bda49e58d436b13beb6cec4c6652ac33fd09accbdf0a7b4523303c1028e9336a0fff02664

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Vimeo%20MP4.dat

Filesize
482B

MD5
c8aa019395c5da3d66aad9b42010dfa4

SHA1
710f8a238807960b7e9b144333129260db52b545

SHA256
b2852e173472c68d093341dbc0757505d54a6ee0ec6cc4ec7c89f7f1e1b32d23

SHA512
27b0bdd33b57507bf30076385c806f1ab1c489daf1883d748674a5cd39a73e91a431f30c908047f48d97c85a5461135e7cbdf499078ca0fd14e1bbea42b72127

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\Widescreen%20TV.dat

Filesize
482B

MD5
52efff8aa9febbacbdd819aeb3f4d9df

SHA1
a13e9b88c5619297a1f0e1959357252d6bf5be14

SHA256
c03878f47765535655a187bed85f3c8a29a2d34cb85bb12871376f939e17e454

SHA512
1edff88102d57b23de2e13678514539b84c80f6f7de06e7be11c0f4d5ea7225c26990cef9ce4072dadbe57a3168415ba04af7c7e7ca7b15cc64aabca22bd0f28

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\YouTube%20-%20Vertical%20Video%20%281%3A2%29.dat

Filesize
483B

MD5
85e08f6cd7ca4f89ccc591f6978de2b4

SHA1
34f746d373da245a9dac73d1d45d26104976db60

SHA256
30177d88b89e3a5d54647d7ed4c9e7922106ba0f54bfda5f1b0f61f04a97f773

SHA512
b6be4886457732cf225eea10084b87c4480123ea6a981f4efb86cf9cd850994321d36b1530201feee4d3d04b7c4e293177be69ce93d2a7d6167a7696662809b5

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\YouTube%20-%20Vertical%20Video%20%282%3A3%29.dat

Filesize
482B

MD5
d670bdf7adb087a8a05bf59e9e295ade

SHA1
e07fa5e1e78d4e699261381a63d9b984d56425cb

SHA256
8a6aab0dc4469a2e3b9f352c42b12857454c43f13a73a0671e0fab8bc7b67357

SHA512
6de38711fa266999335ce90b91dac858f03919b67f464d64b85772e429ca5b50bada7cfbc916001896ef806c68270c4af3350412916f59aff10ff8d3c9ce3a3a

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\GoogleDrivePresets\YouTube%20480p.dat

Filesize
481B

MD5
256f46cdfd255a5ad4f9e549ba518b70

SHA1
3e3ca3bb0e0bd9aa0d431ec38e3f1bdda5ccee24

SHA256
c6b68f3e9ca18b14508a024c8ee3ed6ecdcdc3d7735b0e21da69a84ada311c2f

SHA512
07e5b49c365989d37fdf1690b948676e20273927ca3cb1bb0c816b59ba2feb8474017b0f958604ad9aaa0650af32992fa5e69db3891f56be76ad0f66ae7fc210

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\PortablePresets\AppleiPad5.dat

Filesize
483B

MD5
93ed1eadc6cf992624ae703f1d81e42a

SHA1
a4d7cf66708a833cec8c57a4f74ebe45c1e71619

SHA256
e384d667ca18eb01dba8c1ad7b5bf629a03d44e70736161f03c9a6ee6f1f2b55

SHA512
a8560abed03b0d8b945b6552d3e4b9f4143aa536bc47955f7a782b8bf2c6a4b8fef4a21615313b473e5c9478c8e849fa2b10c628d56f028445c6cfdc863e6aee

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\PortablePresets\AppleiPadAir.dat

Filesize
483B

MD5
a4ccf0d8d6f79e90e2e163659fccebf8

SHA1
350a7ab14a263422de742eec3bbfacceb3dcc629

SHA256
ff59d543dd7d82ec91365f816c06b0c122b8a34d34b238486ef5931de1d05666

SHA512
e8f48fa579c83e92bffa13fd7ec2f8bb5f48f0bf189bc1339024b796e339e2a98306ccf2fefb94d514b4a5d080b01df1685502a6b7de2f891bc4df18befc6342

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\PortablePresets\AppleiPodTouch2.dat

Filesize
481B

MD5
520afaefdc4e6c66adc291a8d114c14e

SHA1
24fa045eaef7b8186107c916ae032761b1168f02

SHA256
42aae7247c976e249884fa55aefcf7a2c56d8319de520d31ba92df032b838795

SHA512
57f6b299416dc83da2af07d940a3cdeb5bf78e86e1c09d6ed01b77dcfcb40345c5c2a941bf831206716bf0a6d2198a59d8266d74bbfb3a182c05606219b9db13

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\effects_transitions\effects\15.png

Filesize
2KB

MD5
85464b3c95d18a7024433b5975d1f98b

SHA1
6ea8f26960403fd6a3e28000af1d057c96fbe029

SHA256
15762de58124bca4a7b8ae21c812d72e25839048151ecc51d6408537b35f1ff6

SHA512
c682083f71778eedfc8feeb814ce596e92ab4fc3e2e6f55e06c99c8c5b4cd31027996635c76176c45f45d1009efd88504df44746e063e61bd52a5c8b13910ad2

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\VideoPad\effects_transitions\effects\74.png

Filesize
5KB

MD5
faff3285ead9bafb5704245e90308af1

SHA1
6a705deb8aa539d49996c88d1794c372399fbad8

SHA256
94fb6f113619d4b9300bcd7853ec05ecc3b557bcb6824f3c987cf4a4bf5802a2

SHA512
c5bfefed813683b8a595609964fc2c31b3dc3cbe4ab950b1b01ddc0d2c0f846f7a4c57f78fe0c44c2a2675184874947a21b82b26aefb0119c9ec2a1ad8642c8d

Download Submit
\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe

Filesize
215KB

MD5
fdbcf6d959114f3b21b1a66b606bbfe6

SHA1
bdb49a613ba82ad1bfe5db6da65ac53e2c3007d2

SHA256
fbaf4b67d2ec4efaf001331c633b3abee706fc805d4e3736a4ebc5391775ddac

SHA512
2ca2bbd174f132f5edd0fec1b420794125bb7ec66b6d8e063ced7eb81fba36c03b4b6f6cf3272a74c687471111727948cd1d21b32a8aeb29dfb19a7a6f66d425

Download Submit
\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe

Filesize
215KB

MD5
fdbcf6d959114f3b21b1a66b606bbfe6

SHA1
bdb49a613ba82ad1bfe5db6da65ac53e2c3007d2

SHA256
fbaf4b67d2ec4efaf001331c633b3abee706fc805d4e3736a4ebc5391775ddac

SHA512
2ca2bbd174f132f5edd0fec1b420794125bb7ec66b6d8e063ced7eb81fba36c03b4b6f6cf3272a74c687471111727948cd1d21b32a8aeb29dfb19a7a6f66d425

Download Submit
\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe

Filesize
215KB

MD5
fdbcf6d959114f3b21b1a66b606bbfe6

SHA1
bdb49a613ba82ad1bfe5db6da65ac53e2c3007d2

SHA256
fbaf4b67d2ec4efaf001331c633b3abee706fc805d4e3736a4ebc5391775ddac

SHA512
2ca2bbd174f132f5edd0fec1b420794125bb7ec66b6d8e063ced7eb81fba36c03b4b6f6cf3272a74c687471111727948cd1d21b32a8aeb29dfb19a7a6f66d425

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Program Files (x86)\NCH Software\VideoPad\videopad.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Users\Admin\AppData\Local\Temp\VideoPad-2156-1\ffmpeg23.exe

Filesize
3.2MB

MD5
8f2dbfdbbf7d110e5093df464197641a

SHA1
8b16c932276d957103d305803b10c6d70b029680

SHA256
7cbb0774164efb5fb4a170cc854e184d8ca67ce796b6bda632fb692e89abec27

SHA512
bdcf6897575efad3eb4ccaf3c73503ed39cc0921b4f88ec24efc6597311f80422d36924599d06de244d7ab244f034693e3e6b4dacb6eee09fbadba17d075aea0

Download Submit
\Users\Admin\AppData\Local\Temp\VideoPad-2156-1\ffmpeg23.exe

Filesize
3.2MB

MD5
8f2dbfdbbf7d110e5093df464197641a

SHA1
8b16c932276d957103d305803b10c6d70b029680

SHA256
7cbb0774164efb5fb4a170cc854e184d8ca67ce796b6bda632fb692e89abec27

SHA512
bdcf6897575efad3eb4ccaf3c73503ed39cc0921b4f88ec24efc6597311f80422d36924599d06de244d7ab244f034693e3e6b4dacb6eee09fbadba17d075aea0

Download Submit
\Users\Admin\AppData\Local\Temp\VideoPad-2156-1\ffmpeg23.exe

Filesize
3.2MB

MD5
8f2dbfdbbf7d110e5093df464197641a

SHA1
8b16c932276d957103d305803b10c6d70b029680

SHA256
7cbb0774164efb5fb4a170cc854e184d8ca67ce796b6bda632fb692e89abec27

SHA512
bdcf6897575efad3eb4ccaf3c73503ed39cc0921b4f88ec24efc6597311f80422d36924599d06de244d7ab244f034693e3e6b4dacb6eee09fbadba17d075aea0

Download Submit
\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
11.7MB

MD5
969684068c64860b9e2d7415da6f7ec2

SHA1
0c12c3320a8721a1af276a608cdf49976da6cbb0

SHA256
ab85c75fd1e7856c9ccab5d58e7c80809c29e73ec064a90fc297bbfc7c051a7a

SHA512
389134e95e4c1673e268333932ff66e889c4b1929c4cb34113139fa185e351b05915dfe584fda3ac1ae8606cf1318ef034f8a574af03ad271453a7d7b3fb8560

Download Submit
memory/2360-137-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2360-76-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download